[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEJKW3SSDR9WQPZJRGQBSR":3,"skill-same:01M6AEJKW3SSDR9WQPZJRGQBSR":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":94,"commitSha":95,"skillDirectory":96,"forksCount":97,"repositoryHtmlUrl":98,"repositoryHomepageUrl":99,"ownerHtmlUrl":100,"ownerBlogUrl":101,"ownerDescription":102,"updatedAt":103,"install":104,"resources":117},"01M6AEJKW3SSDR9WQPZJRGQBSR","detecting-t1003-credential-dumping-with-edr",null,"Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting t1003 credential dumping with edr","t1003","edr","sysmon","sam-database","ntds","mitre-t1003","lsass","credential-dumping","reconnaissance","security","threat-hunting","mimikatz","logs","file","database","telemetry","windows","cybersecurity","memory","2026-11-10 10:12:30",false,"---\nname: detecting-t1003-credential-dumping-with-edr\ndescription: Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM\n  database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access\n  events, and Windows security event logs. Use when hunting for Mimikatz-style credential\n  theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected\n  credential dumping.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- credential-dumping\n- lsass\n- mitre-t1003\n- edr\n- mimikatz\n- ntds\n- sam-database\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Application Protocol Command Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1003.001\n- T1003.002\n- T1003.003\n- T1003.006\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - positioning\n  - initial-access\n  techniques:\n  - id: T1555\n    name: Credentials from Password Stores\n    tactic: reconnaissance\n    source: attack\n  - id: T1555.003\n    name: 'Credentials from Password Stores: Credentials from Web Browsers'\n    tactic: reconnaissance\n    source: attack\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n---\n\n# Detecting T1003 Credential Dumping with EDR\n\n## When to Use\n\n- When hunting for credential theft activity in the environment\n- After compromise indicators suggest attacker has elevated privileges\n- When EDR alerts fire for LSASS access or suspicious process memory reads\n- During incident response to determine scope of credential compromise\n- When auditing LSASS protection controls (Credential Guard, RunAsPPL)\n\n## Prerequisites\n\n- EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)\n- Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters\n- Windows Security Event ID 4656\u002F4663 (Object Access Auditing)\n- LSASS SACL auditing enabled (Windows 10+)\n- Registry auditing for SAM hive access\n\n## Workflow\n\n1. **Monitor LSASS Process Access**: Track all processes opening handles to lsass.exe with suspicious access rights (PROCESS_VM_READ 0x0010, PROCESS_ALL_ACCESS 0x1FFFFF). Non-privileged or unusual processes accessing LSASS are strong indicators.\n2. **Detect Credential Dumping Tools**: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS dumps.\n3. **Monitor NTDS.dit Access**: Detect Volume Shadow Copy creation (vssadmin, wmic shadowcopy) followed by NTDS.dit file access, or ntdsutil.exe IFM creation.\n4. **Track SAM\u002FSECURITY\u002FSYSTEM Hive Access**: Hunt for reg.exe save commands targeting SAM, SECURITY, and SYSTEM registry hives.\n5. **Detect DCSync Activity**: Monitor for non-DC accounts requesting directory replication (Event 4662 with replication GUIDs).\n6. **Correlate with Lateral Movement**: After credential dumping, attackers typically move laterally. Correlate credential access events with subsequent remote logon attempts.\n7. **Assess Impact**: Determine which credentials were potentially compromised and initiate password resets.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1003.001 | LSASS Memory -- dumping credentials from LSASS process |\n| T1003.002 | Security Account Manager -- extracting local account hashes from SAM |\n| T1003.003 | NTDS -- extracting domain hashes from Active Directory database |\n| T1003.004 | LSA Secrets -- extracting service account passwords |\n| T1003.005 | Cached Domain Credentials -- extracting DCC2 hashes |\n| T1003.006 | DCSync -- replicating credentials from domain controller |\n| Credential Guard | Virtualization-based isolation of LSASS secrets |\n| RunAsPPL | Protected Process Light for LSASS |\n\n## Detection Queries\n\n### Splunk -- LSASS Access Detection\n```spl\nindex=sysmon EventCode=10\n| where match(TargetImage, \"(?i)lsass\\.exe$\")\n| where GrantedAccess IN (\"0x1FFFFF\", \"0x1F3FFF\", \"0x143A\", \"0x1F0FFF\", \"0x0040\", \"0x1010\", \"0x1410\")\n| where NOT match(SourceImage, \"(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE|taskmgr|procexp|SecurityHealthService)\\.exe$\")\n| table _time Computer SourceImage SourceProcessId GrantedAccess CallTrace\n```\n\n### Splunk -- Credential Dumping Tool Detection\n```spl\nindex=sysmon EventCode=1\n| where match(CommandLine, \"(?i)(sekurlsa|lsadump|kerberos::list|crypto::certificates)\")\n    OR match(CommandLine, \"(?i)procdump.*-ma.*lsass\")\n    OR match(CommandLine, \"(?i)comsvcs\\.dll.*MiniDump\")\n    OR match(CommandLine, \"(?i)ntdsutil.*\\\"ac i ntds\\\".*ifm\")\n    OR match(CommandLine, \"(?i)reg\\s+save\\s+hklm\\\\\\\\(sam|security|system)\")\n    OR match(CommandLine, \"(?i)vssadmin.*create\\s+shadow\")\n| table _time Computer User Image CommandLine ParentImage\n```\n\n### KQL -- Microsoft Defender for Endpoint\n```kql\nDeviceEvents\n| where Timestamp > ago(7d)\n| where ActionType in (\"LsassAccess\", \"CredentialDumpingActivity\")\n| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,\n    InitiatingProcessCommandLine, ActionType, AdditionalFields\n| sort by Timestamp desc\n```\n\n### Sigma Rule -- LSASS Credential Dumping\n```yaml\ntitle: LSASS Memory Credential Dumping Attempt\nstatus: stable\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccess|contains:\n            - '0x1FFFFF'\n            - '0x1F3FFF'\n            - '0x143A'\n            - '0x0040'\n    filter:\n        SourceImage|endswith:\n            - '\\csrss.exe'\n            - '\\lsass.exe'\n            - '\\MsMpEng.exe'\n            - '\\svchost.exe'\n    condition: selection and not filter\nlevel: critical\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n```\n\n## Common Scenarios\n\n1. **Mimikatz sekurlsa**: Direct LSASS memory reading via `sekurlsa::logonpasswords` to extract plaintext passwords, NTLM hashes, and Kerberos tickets.\n2. **ProcDump LSASS**: `procdump.exe -ma lsass.exe lsass.dmp` creating a memory dump for offline credential extraction.\n3. **Comsvcs.dll MiniDump**: `rundll32.exe comsvcs.dll MiniDump [LSASS_PID] dump.bin full` using a built-in Windows DLL for LSASS dumping.\n4. **NTDS.dit Extraction**: Creating a Volume Shadow Copy and copying NTDS.dit + SYSTEM hive for offline domain hash extraction with secretsdump.\n5. **SAM Hive Export**: `reg save HKLM\\SAM sam.save` followed by `reg save HKLM\\SYSTEM system.save` for local account hash extraction.\n6. **Task Manager Dump**: Right-clicking LSASS in Task Manager to create a memory dump -- a legitimate tool abused for credential theft.\n\n## Output Format\n\n```\nHunt ID: TH-CRED-[DATE]-[SEQ]\nHost: [Hostname]\nDumping Method: [LSASS_Access\u002FNTDS\u002FSAM\u002FDCSync]\nSource Process: [Tool or process used]\nTarget: [LSASS\u002FNTDS.dit\u002FSAM\u002FSECURITY]\nAccess Rights: [Granted access mask]\nUser Context: [Account performing the dump]\nATT&CK Technique: [T1003.00x]\nRisk Level: [Critical\u002FHigh\u002FMedium]\nCredentials at Risk: [Scope assessment]\n```\n","# Detecting T1003 Credential Dumping with EDR\n\n## When to Use\n\n- When hunting for credential theft activity in the environment\n- After compromise indicators suggest attacker has elevated privileges\n- When EDR alerts fire for LSASS access or suspicious process memory reads\n- During incident response to determine scope of credential compromise\n- When auditing LSASS protection controls (Credential Guard, RunAsPPL)\n\n## Prerequisites\n\n- EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)\n- Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters\n- Windows Security Event ID 4656\u002F4663 (Object Access Auditing)\n- LSASS SACL auditing enabled (Windows 10+)\n- Registry auditing for SAM hive access\n\n## Workflow\n\n1. **Monitor LSASS Process Access**: Track all processes opening handles to lsass.exe with suspicious access rights (PROCESS_VM_READ 0x0010, PROCESS_ALL_ACCESS 0x1FFFFF). Non-privileged or unusual processes accessing LSASS are strong indicators.\n2. **Detect Credential Dumping Tools**: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS dumps.\n3. **Monitor NTDS.dit Access**: Detect Volume Shadow Copy creation (vssadmin, wmic shadowcopy) followed by NTDS.dit file access, or ntdsutil.exe IFM creation.\n4. **Track SAM\u002FSECURITY\u002FSYSTEM Hive Access**: Hunt for reg.exe save commands targeting SAM, SECURITY, and SYSTEM registry hives.\n5. **Detect DCSync Activity**: Monitor for non-DC accounts requesting directory replication (Event 4662 with replication GUIDs).\n6. **Correlate with Lateral Movement**: After credential dumping, attackers typically move laterally. Correlate credential access events with subsequent remote logon attempts.\n7. **Assess Impact**: Determine which credentials were potentially compromised and initiate password resets.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1003.001 | LSASS Memory -- dumping credentials from LSASS process |\n| T1003.002 | Security Account Manager -- extracting local account hashes from SAM |\n| T1003.003 | NTDS -- extracting domain hashes from Active Directory database |\n| T1003.004 | LSA Secrets -- extracting service account passwords |\n| T1003.005 | Cached Domain Credentials -- extracting DCC2 hashes |\n| T1003.006 | DCSync -- replicating credentials from domain controller |\n| Credential Guard | Virtualization-based isolation of LSASS secrets |\n| RunAsPPL | Protected Process Light for LSASS |\n\n## Detection Queries\n\n### Splunk -- LSASS Access Detection\n```spl\nindex=sysmon EventCode=10\n| where match(TargetImage, \"(?i)lsass\\.exe$\")\n| where GrantedAccess IN (\"0x1FFFFF\", \"0x1F3FFF\", \"0x143A\", \"0x1F0FFF\", \"0x0040\", \"0x1010\", \"0x1410\")\n| where NOT match(SourceImage, \"(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE|taskmgr|procexp|SecurityHealthService)\\.exe$\")\n| table _time Computer SourceImage SourceProcessId GrantedAccess CallTrace\n```\n\n### Splunk -- Credential Dumping Tool Detection\n```spl\nindex=sysmon EventCode=1\n| where match(CommandLine, \"(?i)(sekurlsa|lsadump|kerberos::list|crypto::certificates)\")\n    OR match(CommandLine, \"(?i)procdump.*-ma.*lsass\")\n    OR match(CommandLine, \"(?i)comsvcs\\.dll.*MiniDump\")\n    OR match(CommandLine, \"(?i)ntdsutil.*\\\"ac i ntds\\\".*ifm\")\n    OR match(CommandLine, \"(?i)reg\\s+save\\s+hklm\\\\\\\\(sam|security|system)\")\n    OR match(CommandLine, \"(?i)vssadmin.*create\\s+shadow\")\n| table _time Computer User Image CommandLine ParentImage\n```\n\n### KQL -- Microsoft Defender for Endpoint\n```kql\nDeviceEvents\n| where Timestamp > ago(7d)\n| where ActionType in (\"LsassAccess\", \"CredentialDumpingActivity\")\n| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,\n    InitiatingProcessCommandLine, ActionType, AdditionalFields\n| sort by Timestamp desc\n```\n\n### Sigma Rule -- LSASS Credential Dumping\n```yaml\ntitle: LSASS Memory Credential Dumping Attempt\nstatus: stable\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccess|contains:\n            - '0x1FFFFF'\n            - '0x1F3FFF'\n            - '0x143A'\n            - '0x0040'\n    filter:\n        SourceImage|endswith:\n            - '\\csrss.exe'\n            - '\\lsass.exe'\n            - '\\MsMpEng.exe'\n            - '\\svchost.exe'\n    condition: selection and not filter\nlevel: critical\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n```\n\n## Common Scenarios\n\n1. **Mimikatz sekurlsa**: Direct LSASS memory reading via `sekurlsa::logonpasswords` to extract plaintext passwords, NTLM hashes, and Kerberos tickets.\n2. **ProcDump LSASS**: `procdump.exe -ma lsass.exe lsass.dmp` creating a memory dump for offline credential extraction.\n3. **Comsvcs.dll MiniDump**: `rundll32.exe comsvcs.dll MiniDump [LSASS_PID] dump.bin full` using a built-in Windows DLL for LSASS dumping.\n4. **NTDS.dit Extraction**: Creating a Volume Shadow Copy and copying NTDS.dit + SYSTEM hive for offline domain hash extraction with secretsdump.\n5. **SAM Hive Export**: `reg save HKLM\\SAM sam.save` followed by `reg save HKLM\\SYSTEM system.save` for local account hash extraction.\n6. **Task Manager Dump**: Right-clicking LSASS in Task Manager to create a memory dump -- a legitimate tool abused for credential theft.\n\n## Output Format\n\n```\nHunt ID: TH-CRED-[DATE]-[SEQ]\nHost: [Hostname]\nDumping Method: [LSASS_Access\u002FNTDS\u002FSAM\u002FDCSync]\nSource Process: [Tool or process used]\nTarget: [LSASS\u002FNTDS.dit\u002FSAM\u002FSECURITY]\nAccess Rights: [Granted access mask]\nUser Context: [Account performing the dump]\nATT&CK Technique: [T1003.00x]\nRisk Level: [Critical\u002FHigh\u002FMedium]\nCredentials at Risk: [Scope assessment]\n```\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"mitre_f3":55,"nist_csf":78,"subdomain":38,"description":7,"mitre_attack":83,"d3fend_techniques":88},[38,35,34,33,29,39,32,31],"mahipal","1.0",{"tactics":56,"version":59,"techniques":60},[36,57,58],"positioning","initial-access","1.1",[61,65,68,71,75],{"id":62,"name":63,"source":64,"tactic":36},"T1555","Credentials from Password Stores","attack",{"id":66,"name":67,"source":64,"tactic":36},"T1555.003","Credentials from Password Stores: Credentials from Web Browsers",{"id":69,"name":70,"source":64,"tactic":57},"T1539","Steal Web Session Cookie",{"id":72,"name":73,"source":74,"tactic":58},"F1006","Account Takeover","f3",{"id":76,"name":77,"source":74,"tactic":58},"F1006.002","Account Takeover: Exposed Login Credential",[79,80,81,82],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[84,85,86,87],"T1003.001","T1003.002","T1003.003","T1003.006",[89,90,91,92,93],"Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-t1003-credential-dumping-with-edr",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":105,"prompt":115,"zipAvailable":116},[106,109,112],{"tool":107,"command":108},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr",{"tool":110,"command":111},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr",{"tool":113,"command":114},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-t1003-credential-dumping-with-edr","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002FSKILL.md",true,[118,124,129,135,139,143,149],{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"assets\u002Ftemplate.md","ASSET","资产文件",1184,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Fassets\u002Ftemplate.md",{"path":125,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002FLICENSE",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fapi-reference.md","REFERENCE","参考文档",2532,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Freferences\u002Fapi-reference.md",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fstandards.md",2226,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Freferences\u002Fstandards.md",{"path":140,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fworkflows.md",2270,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Freferences\u002Fworkflows.md",{"path":144,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fagent.py","SCRIPT","脚本",6708,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Fscripts\u002Fagent.py",{"path":150,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fprocess.py",5131,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-t1003-credential-dumping-with-edr\u002Fscripts\u002Fprocess.py",[154,180,204,232,256,283],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[160],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[162,163,164,165,37,45,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[186],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[188,176,189,190,37,191,45,168,192,193,194,195,196,197,198,199,200,201,202,203],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":214,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[210,213],{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[198,215,216,217,218,45,219,220,192,221,222,223,224,225,226,227,228,229,230,231],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[238],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[44,240,241,45,242,243,40,244,245,246,247,248,249,250,251,252,195,253,254,255],"kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[262],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[264,265,266,45,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":284,"name":285,"nameZh":6,"description":286,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":287,"categories":288,"keywords":290,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[289],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[37,291,45,292,41,293,294,295,296,297,29,227,298,228,299,300,301,302,303,304],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]